← CVE Intelligence

CVE-2024-10394

Theft of credentials in Unix client PAGs PUBLISHED

Description (CNA)

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Affected (CNA)

Vendor / productVersions
The OpenAFS Foundation / OpenAFSaffected 1.0 before 1.6.24; affected 1.8.0 before 1.8.12.2; affected 1.9.0 before 1.9.1

CWE

CWE-305

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.